Mounting an image with multiple partitions

Originally published on the old depletionmode / 2of1 blog (archived copy).

In security research, it’s sometimes necessary to mount an image with multiple partitions.

Mounting a ‘dd’ image of a single partition is trivial using mount, however mount can simply not know to deal with an image with multiple partitions, mbr, etc. (for e.g. a disk drive image).

Luckily mounting multiple partitions is fairly easy as well.

Running fdisk -lu prints out some useful information:

$ fdisk -lu disk.img
You must set cylinders.
You can do this from the extra functions menu.
 
Disk disk.img: 0 MB, 0 bytes
16 heads, 32 sectors/track, 0 cylinders, total 0 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000
 
   Device Boot      Start         End      Blocks   Id  System
disk.img1               1      278527      139263+  83  Linux
disk.img2          278528      311295       16384   83  Linux
disk.img3          311296      327679        8192   83  Linux
disk.img4          327680      501759       87040   83  Linux

We can see that in the above example, there are 4 linux partitions. At this point we’ll need to know what filesystems each partition uses – but that’s another discussion (lets assume that all are ext3).

It is also important to note from the fdisk output that 1 sector = 512 bytes.

Mounting each partition can be done with the help of a loop device (/dev/loopX).
You don’t even need to bother with the device itself, mount can manage it all for you.

The only think you need to know is the offset of the start sector of the partition you’re interested in.
So for example, if we wish to mount the disk.img2 partition, we work out the offset:
start sector * sector size = offset
278528 * 512 = 142606336

Mounting can now be done as follows:

mount -t ext3 -o loop,offset=142606336 disk.img2 /mnt/disk2